Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass (CVE-2018-19788)

  - The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka     polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action     descriptions. (CVE-2015-3255)

  - Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113     allows local users to gain privileges by creating a large number of connections, which triggers the     issuance of a duplicate cookie value. (CVE-2015-4625)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - polkit: potential information disclosure vulnerability due to cookie counter wrapping (CVE-2015-4625)

  - polkit: Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctl     (CVE-2016-2568)

  - The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit     (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and     polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path. (CVE-2015-3218)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the polkit package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - A NULL-pointer dereference flaw was discovered in     polkitd. A malicious, local user could exploit this     flaw to crash polkitd.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - It was found that Polkit's CheckAuthorization and     RegisterAuthenticationAgent D-Bus calls did not     validate the client provided UID. A specially crafted     program could use this flaw to submit arbitrary UIDs,     triggering various denial of service or minor     disclosures, such as which authentication is cached in     the victim's session.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3717-1 advisory.

    Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker     could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS. (CVE-2015-3218)

    It was discovered that PolicyKit incorrectly handled certain duplicate action IDs. A local attacker could     use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate     privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3255)

    Tavis Ormandy discovered that PolicyKit incorrectly handled duplicate cookie values. A local attacker     could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate     privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-4625)

    Matthias Gerstner discovered that PolicyKit incorrectly checked users. A local attacker could possibly use     this issue to cause authentication dialogs to show up for other users, leading to a denial of service or     an information leak. (CVE-2018-1116)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Colin Walters reports :

- Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.

- The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.

- The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

- PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to 'javascript rule evaluation.'

polkit was updated to the 0.113 release, fixing security issues and bugs.

Security issues fixed :

  - Fixes CVE-2015-4625, a local privilege escalation due to     predictable authentication session cookie values. Thanks     to Tavis Ormandy, Google Project Zero for reporting this     issue. For the future, authentication agents are     encouraged to use PolkitAgentSession instead of using     the D-Bus agent response API directly. (bsc#935119)

  - Fixes CVE-2015-3256, various memory corruption     vulnerabilities in use of the JavaScript interpreter,     possibly leading to local privilege escalation.
    (bsc#943816)

  - Fixes CVE-2015-3255, a memory corruption vulnerability     in handling duplicate action IDs, possibly leading to     local privilege escalation. Thanks to Laurent Bigonville     for reporting this issue. (bsc#939246)

  - Fixes CVE-2015-3218, which allowed any local user to     crash polkitd. Thanks to Tavis Ormandy, Google Project     Zero, for reporting this issue. (bsc#933922)

Other issues fixed :

  - On systemd-213 and later, the 'active' state is shared     across all sessions of an user, instead of being tracked     separately.

  - pkexec, when not given a program to execute, runs the     users shell by default.

  - Fixed shutdown problems on powerpc64le (bsc#950114)

  - polkit had a memory leak (bsc#912889)

polkit was updated to the 0.113 release, fixing security issues and bugs.

Security issues fixed :

  - Fixes CVE-2015-4625, a local privilege escalation due to     predictable authentication session cookie values. Thanks     to Tavis Ormandy, Google Project Zero for reporting this     issue. For the future, authentication agents are     encouraged to use PolkitAgentSession instead of using     the D-Bus agent response API directly. (bsc#935119)

  - Fixes CVE-2015-3256, various memory corruption     vulnerabilities in use of the JavaScript interpreter,     possibly leading to local privilege escalation.
    (bsc#943816)

  - Fixes CVE-2015-3255, a memory corruption vulnerability     in handling duplicate action IDs, possibly leading to     local privilege escalation. Thanks to Laurent Bigonville     for reporting this issue. (bsc#939246)

  - Fixes CVE-2015-3218, which allowed any local user to     crash polkitd. Thanks to Tavis Ormandy, Google Project     Zero, for reporting this issue. (bsc#933922)

Other issues fixed :

  - On systemd-213 and later, the 'active' state is shared     across all sessions of an user, instead of being tracked     separately.

  - pkexec, when not given a program to execute, runs the     users shell by default.

  - Fixed shutdown problems on powerpc64le (bsc#950114)

  - polkit had a memory leak (bsc#912889)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Polkit was updated to 0.113 to fix four security issues.

The following vulnerabilities were fixed :

  - CVE-2015-4625: a local privilege escalation due to     predictable authentication session cookie values.
    (boo#935119)

  - CVE-2015-3256: various memory corruption vulnerabilities     in use of the JavaScript interpreter, possibly leading     to local privilege escalation. (boo#943816)

  - CVE-2015-3255: a memory corruption vulnerability in     handling duplicate action IDs, possibly leading to local     privilege escalation. (boo#939246)

  - CVE-2015-3218: Allowed any local user to crash polkitd.
    (boo#933922)

Security fix for CVE-2015-3218, CVE-2015-3255, CVE-2015-3256, CVE-2015-4625.

Please make sure to reboot or run (systemctl restart polkit.service) after applying this update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-3218, CVE-2015-3255, CVE-2015-3256, CVE-2015-4625

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199781	RHEL 6 : polkit (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199778	RHEL 7 : polkit (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
135625	EulerOS Virtualization 3.0.2.2 : polkit (EulerOS-SA-2020-1463)	Nessus	Huawei Local Security Checks	high
135553	EulerOS 2.0 SP3 : polkit (EulerOS-SA-2020-1424)	Nessus	Huawei Local Security Checks	medium
134482	EulerOS Virtualization for ARM 64 3.0.2.0 : polkit (EulerOS-SA-2020-1193)	Nessus	Huawei Local Security Checks	high
131896	EulerOS 2.0 SP2 : polkit (EulerOS-SA-2019-2404)	Nessus	Huawei Local Security Checks	medium
130685	EulerOS 2.0 SP5 : polkit (EulerOS-SA-2019-2223)	Nessus	Huawei Local Security Checks	high
111135	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PolicyKit vulnerabilities (USN-3717-1)	Nessus	Ubuntu Local Security Checks	medium
87831	FreeBSD : polkit -- multiple vulnerabilities (631fc042-b636-11e5-83ef-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
86957	openSUSE Security Update : polkit (openSUSE-2015-711)	Nessus	SuSE Local Security Checks	medium
86649	SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2015:1838-1)	Nessus	SuSE Local Security Checks	medium
86390	openSUSE Security Update : polkit (openSUSE-2015-655)	Nessus	SuSE Local Security Checks	medium
84907	Fedora 21 : polkit-0.113-4.fc21 (2015-11743)	Nessus	Fedora Local Security Checks	medium
84686	Fedora 22 : polkit-0.113-1.fc22 (2015-11058)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-4625

medium

Tenable Plugins

high

high

high

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium